[Libguestfs] Inspect running disk image

NoxDaFox noxdafox at gmail.com
Wed Jan 23 07:44:43 UTC 2013


Greetings,

I'd like to monitor the FS activities (read/write) at runtime on
several virtual disk images running on Qemu KVM.
The aim is to periodically inspect these images to identify possible
Windows registry modification, file creation and so on..

What should be the optimal procedure? Shall I launch a new handler
each time? It is a quite expensive procedure and it takes a lot of
time on loaded systems.
Would be enough to mount/unmount the disk at each read?

noxdafox




More information about the Libguestfs mailing list